The IntelCS boundary
Source systems
Read-only, least-privilege connectors
Extraction
Local parsing, no external OCR or embedding calls
HaloRT inference
Our own models, on our own hardware
Evidence ledger
Append-only, encrypted, per-client keys
Reviewer workspace
SSO, RBAC, full access logging
Onward data flow to any third-party AI vendor:
None
Controls
What your security review will ask, answered up front.
Where does inference run?
On IntelCS infrastructure, inside a single-tenant instance dedicated to your organisation. The models are ours and the hardware is ours — so there is no external third party inference call at any point in the pipeline.
Is our data used to train anything?
No. Your data is used to answer your review and for nothing else — not training, not tuning, not evaluation, not benchmarking, and never across client instances.
Which sub-processors see the data?
For the review pipeline: none. There is no AI sub-processor to add to your register, which removes an entire class of third-party and cross-border transfer assessment.
How is access controlled?
SSO through your identity provider, role-based access aligned to your review roles, enforced segregation of duties between authoring, approving and signing off, and append-only access logging.
Can we verify what the system did?
Yes. Every run emits a signed manifest — inputs, ruleset version, sealed model digest, environment — and any run can be re-executed to the same result. How HaloRT does that.
How do updates reach the system?
On a release schedule agreed with you, as signed, content-addressed artefacts. Nothing changes silently — a model, prompt or runtime change is a versioned event and a notice period.
Governance fit
Built for the frameworks your assurance team already runs.
AI governance expectations have moved from principles to enforceable requirements: risk classification, lifecycle documentation, human oversight and demonstrable consistency. Local hosting and deterministic execution make most of those requirements straightforward rather than contested.
IntelCS is a control that supports your obligations — it does not claim to certify you. We give your second and third lines the artefacts they need to form their own opinion.
Model documentation — sealed model digest, intended use, configuration and evaluation records per deployment.
Human oversight — exceptions require a named reviewer; automated outcomes are never final on contested cases.
Traceability — every finding links to input, rule version, reasoning and reviewer decision.
Data minimisation — read-only, scoped connectors; retention and residency follow your policy, not ours.
Change control — model, prompt and ruleset changes are versioned, signed and applied on your schedule.